/**
 * auth-refresh-kubernetes.ts — D4 kubernetes Secret rotation for `olam auth refresh`.
 *
 * Extracted from auth.ts to keep the testable logic free of @olam/core dependencies.
 * No @olam/core imports here — tested directly by auth.test.ts without needing
 * to mock the entire @olam/core workspace package.
 *
 * D20 security invariant: secret value NEVER in subprocess argv (–from-literal forbidden).
 * SEC-NEW-003: refuses when kubectl_context_pinned absent (no ambient KUBECONFIG fallthrough).
 * ADV-N-003: kubectl rollout restart after apply (K8s does NOT hot-update mounted Secrets).
 */
import { kubectlWrap } from './kubectl-wrap.js';
export interface AuthRefreshKubernetesDeps {
    /** Injectable kubectlWrap for tests (Secret apply + rollout restart). */
    readonly kubectlWrapImpl?: typeof kubectlWrap;
    /** Injectable readFileSync for reading ~/.olam/auth-secret. */
    readonly readFileSyncImpl?: (p: string, enc: 'utf8') => string;
    /** Injectable writeFileSync for writing ~/.olam/auth-secret. */
    readonly writeFileSyncImpl?: (p: string, data: string, opts: {
        mode: number;
    }) => void;
    /** Injectable config path for readConfig. */
    readonly configPath?: string;
    /** Injectable olam home override (for auth-secret path). */
    readonly olamHomeOverride?: string;
    /** Injectable stdout. */
    readonly stdout?: NodeJS.WritableStream;
    /** Injectable stderr. */
    readonly stderr?: NodeJS.WritableStream;
}
/**
 * Construct the olam-host-cp-secret YAML in-process (D20 stdin-safe design).
 * Values are base64-encoded via Buffer. NEVER uses --from-literal in subprocess argv.
 */
export declare function buildSecretYaml(secretName: string, data: Record<string, string>): string;
/**
 * Resolve the pinned kubectl context from config or OLAM_K8S_CONTEXT_ACK fallback.
 *
 * Returns { context } on success.
 * Returns { error } when neither source has a context (SEC-NEW-003 enforcement).
 * Returns { context, deprecationWarning } when OLAM_K8S_CONTEXT_ACK fallback is used.
 *
 * Re-exports the canonical implementation from `kubectl-context.ts` so all
 * call sites share one policy.
 */
export declare function resolveKubectlContext(configPath?: string): {
    context?: string;
    deprecationWarning?: string;
    error?: string;
};
/**
 * Run the kubernetes-substrate portion of auth refresh (D4).
 *
 * Called by auth.ts after a successful `client.refreshAccount()` when
 * the substrate is kubernetes. Performs:
 *   1. Reads ~/.olam/auth-secret for the bearer secret value.
 *   2. Writes ~/.olam/auth-secret back (idempotent, sets mode 0o600).
 *   3. Constructs olam-host-cp-secret YAML in-process (D20: value in stdin, not argv).
 *   4. kubectl apply -f - via stdin pipe.
 *   5. kubectl rollout restart deployment/olam-host-cp -n olam (ADV-N-003).
 *
 * Returns exit code: 0 = success, 1 = error.
 */
export declare function applyK8sAuthRefresh(pinnedContext: string, deps?: AuthRefreshKubernetesDeps): Promise<number>;
//# sourceMappingURL=auth-refresh-kubernetes.d.ts.map